Pocket Guides

Privacy Policy

Pocket Guides

Last updated: 7 October 2026

1. Introduction

Pocket Guides is a trading name of RISENORTHDIGITAL LTD ("we", "us", "our"). We publish the Pocket Guides mobile app (the "App"), and operate the website at pocket-guide.co.uk (the "Website"). This Privacy Policy explains what information we collect through the App and the Website, how we use it, and the rights you have over your information under UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018).

The App is a free local guide to the towns and destinations available in it. You can choose an available guide to explore its places, services and events. You can browse the App without creating an account. You may optionally create an account to save places, walks and events to your own list, to submit new listings or events, or to claim ownership of an existing listing. You can delete your account at any time from inside the App.

This policy explains our data practices. Where we rely on consent, it is separate from this notice; simply reading this policy or using the service is not consent.

2. Who we are

RISENORTHDIGITAL LTD, trading as Pocket Guides, is the data controller for the personal information collected through the App and the Website.

Company: RISENORTHDIGITAL LTD
Trading as: Pocket Guides
Company number: 16485759 (registered in England and Wales)
Registered office: 24 Kings Mill Lane, Settle, United Kingdom, BD24 9FD
Email: hello@pocket-guide.co.uk
Website: pocket-guide.co.uk

3. Information we collect

We have designed the App and the Website to collect as little personal information as possible. The information falls into the categories below. The exact set depends on which features you use.

3a. Information you provide

You can browse the App and the Website without creating an account. Technical information may still be processed as described below. You provide information to us only when you choose to do one of the following:

Create an account. You can sign up with an email address and password, or use Sign in with Apple or Sign in with Google. We store your email address, a display name (your own choice, or one taken from Apple or Google if you sign in with them), and the date your account was created. If you sign in with Apple, you may choose to share a private relay email address (@privaterelay.appleid.com) instead of your real one — we treat that the same as any other email. If you sign in with Apple for the first time, Apple gives us your full name; you can later change or remove this from inside the App.

Save items to your personal list. When you tap the heart on a place, walk or event, we store that against your account so it appears on your Saved tab on any device you sign in to.

Submit a new listing. The in-app "Add a place" form captures the business name, address, category and town (required), plus phone, website, public email address, a description and your reason for submitting (all optional). We also auto-attach your account email and display name so we can follow up if we need to.

Claim an existing listing. If you are the owner or manager of a business already listed in the App, you can claim it. The claim form captures your name and your role (owner, manager, staff, agency or other) as required fields, plus an optional phone number and an optional free-text justification (for example, "owned since 2019, happy to verify by phone"). We use this information solely to decide whether to grant the claim.

Edit your own listing. Once a listing is yours, you can edit its public details (description, opening hours, phone, website, public email, social links) and upload up to ten photos. Every edit you submit goes into a moderation queue and is reviewed before going live. We auto-attach your account email, display name and account ID to every submission so we can audit changes if needed.

Submit an event. The event submission form captures the event title and description, dates and times, venue name and address, event type and your role as the submitter (organiser, host, venue, performer, other) as required fields. Optional fields cover ticket price, ticket link, an external website link, recurrence, and up to ten photos. We also auto-attach your account email and display name, and you can edit the public-facing contact email and name shown against the event.

Report a listing problem. Where this feature is available, a signed-in reader can send a reason and a short explanation about incorrect details, a map pin or a closed business or event. We store the report, the listing and guide identifiers, your account ID, submission time and review outcome in a private moderation queue. Reports are not published and do not change a listing automatically. We also keep a daily count against your account to limit abuse. Do not include sensitive personal information in the explanation.

Recently viewed details and calendar events. The App can keep up to 20 recently viewed public listings on your device for 24 hours so their text remains available without a connection. You can clear this recent list in the App; it is separate from your account's Saved list and optional analytics. Adding an event opens your device's calendar editor, or downloads a calendar file on the web. You choose whether to save it. We do not read your calendar or receive its existing contents.

Photos you upload. Photos you upload through the listing or event forms are stored in our Google Cloud Storage bucket in the United States (US-EAST1), keyed by your account ID or by the listing or event ID. Photos are reviewed by us before being shown publicly. We do not strip metadata from your photos — if your camera saves location information into the photo file (EXIF), that data may be uploaded with it. If you would prefer not to share photo location data, turn off location for photos in your phone's camera settings before taking the picture.

Contact us via the Website. We receive your name, email address, selected topic and message. The contact form also includes your IP address, browser user-agent and submission time in the email sent to us, to help us investigate delivery problems and abuse. The form uses Cloudflare Turnstile for a security check; Cloudflare processes technical browser and connection signals for this purpose. You can also email us directly.

3b. Information collected automatically (in the App)

Optional usage analytics is off until you choose Share usage in the App. If you make that choice, the following optional information is collected until you turn Share usage analytics off in My Account:

  • A Firebase app-instance identifier and analytics events — Google Analytics for Firebase can collect a randomly generated identifier for the App installation, standard usage events (such as session start and app updates), and screen views logged by the App. The App does not request App Tracking Transparency permission, is built without IDFA collection support, disables Apple's Identifier for Vendor (IDFV), and disables Android advertising-ID collection. These identifiers are not your name, email or Pocket Guides account ID.
  • Engagement events to our own database — when you view a place or an event, tap a phone/website/directions/tickets link, or save or unsave an item, we write a short record to our own analytics_events collection in Firestore. Each record contains the action (such as view or save), the target ID, the owner of the listing, your account ID if you are signed in (null if not), and a timestamp. We use these counts to give business owners simple performance stats for their listings and to inform our own product decisions. The records do not contain your name, email, location or device information.

Choosing Keep off, dismissing the choice, or turning the setting off prevents future optional SDK, screen-view and engagement events from being started by the App. Events already sent before you turn the setting off may remain under the retention arrangements below. The choice applies to this device and does not affect saves, accounts, billing, notifications or other App features. The Website's cookie preference is separate from the App setting.

The App also processes the following technical information where the relevant feature is used:

  • Device push token — see section 3d below.
  • Approximate location derived from your IP address — Google's services (Firebase, Maps) may infer an approximate location from your IP address, typically accurate only to country or region. This is not the same as the precise device location described in section 3e.
  • Crash and error information — basic error messages may be sent to Google as part of normal Firebase operation. We do not run a separate crash-reporting tool (such as Crashlytics, Sentry or Bugsnag) in the App.

3c. Information collected automatically (on the Website)

The Website loads Google Analytics 4 only after you choose Accept analytics. It collects usage information such as a client identifier, page views, referrer, approximate location and browser/device details. Reject analytics keeps it disabled. You can change your choice using Cookie preferences in the Website footer.

Business sign-in and listing administration use Firebase services. Your browser stores sign-in state so you can stay signed in, and temporarily remembers your email when you request an email sign-in link. These functions are separate from optional Website analytics.

Where enabled, Firebase App Check uses Google reCAPTCHA Enterprise to assess automated abuse when the Website accesses Firebase services. Google processes browser, device and connection signals for this security check, and may use a security cookie. Firebase stores a short-lived App Check token in your browser. These checks are separate from optional analytics and do not change your analytics or newsletter choices.

3d. Push notification token

If your device is capable of receiving push notifications and you choose to allow them, the App registers a device-specific push token with Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS). We store this token in a devices collection in Firestore alongside your platform (iOS or Android), your notification preferences (whether you have opted in to alerts about sponsored places and/or promoted events), and — once you sign in — your account ID. Before you sign in, the device record is anonymous; after sign-in we link it to your account so we can deliver notifications only to your own devices.

You can turn notifications off at any time in your phone's settings. You can also clear notification preferences from inside the App. You can withdraw consent for any notification category without losing access to the App.

3e. Precise device location (only when you ask for it)

The in-app map includes a "locate me" button. If you tap it, the App asks your device for your current location and centres the map on you. This uses your phone's foreground precise location. We do not track your location in the background, we do not store your location after the map is closed, and we do not send your location to our servers. We only ask for location permission when you first use the "locate me" button — you can decline and continue to use the App normally.

3f. Cookies and similar technologies

The native App uses local device storage and Firebase SDKs for features including sign-in, caching and optional analytics. Storage and access rules can apply to apps as well as browser cookies. Website cookie preferences control Website analytics; they do not change the App's setting.

The Website uses browser storage for sign-in and cookie preferences, and Google Analytics cookies only after you accept analytics. Business listings may have paid placement; this is separate from advertising cookies.

4. How we use your information

We use the information we collect for the following purposes:

  • To provide and operate the App and the Website
  • To authenticate you when you sign in, and to show you the places, walks and events you have saved
  • To review and publish listings, listing claims and events that users submit, and to follow up with submitters where needed
  • To verify that a listing claim is genuine before transferring ownership
  • To deliver push notifications you have opted in to receive
  • To moderate user-submitted content
  • To produce simple performance counts (views, tap-throughs) for the owners of listings and events
  • To understand how the App and the Website are used through aggregated analytics
  • To diagnose and fix technical problems
  • To comply with legal obligations

5. Lawful bases for processing

Under UK GDPR, we rely on the following lawful bases for processing your personal information:

  • Consent — when you choose optional usage analytics in the App; when you submit an event or listing and provide your name and contact details; when you opt in to push notifications; when you allow precise device location for the map; and for Google Analytics cookies on the Website where required.
  • Contract — when you create an account, we process your account information in order to deliver the account features you have asked for (signing you in, showing your saved items, accepting your submissions).
  • Legitimate interests — for the security and integrity of our service and the Website contact form. We weigh these interests against your privacy and only collect what we need.

You can withdraw consent at any time by contacting us at hello@pocket-guide.co.uk, by turning off the relevant permission on your device, or by deleting your account inside the App.

6. Who we share your information with

We use the following services. Their roles depend on the activity: some process information on our behalf, and some also act as independent controllers for their own purposes, as described in their privacy notices:

  • Google Firebase (provided by Google LLC and Google Cloud EMEA Limited) — hosts our database (Firestore), file storage (Cloud Storage for Firebase), authentication, analytics, push messaging and the underlying infrastructure. Our Firestore database is in London (europe-west2); the file-storage bucket is in the United States (US-EAST1). Firebase Authentication also processes sign-in data in the United States, and other services may process information globally. Firebase Authentication handles account sign-in and password management on our behalf, including for Sign in with Google.
  • Sign in with Apple (Apple Inc. / Apple Distribution International Limited) — handles Apple authentication. Apple shares your name (only on first sign-in, only if you allow it) and your email address (which may be a private relay address) with us.
  • Sign in with Google (Google LLC / Google Ireland Limited) — handles Google authentication. Google shares your name, email address and profile photo URL with us.
  • Google Analytics 4 / Google Analytics for Firebase — provides aggregated usage analytics for the App and the Website. See Google's privacy practices at policies.google.com/privacy.
  • Apple Push Notification service (Apple Inc.) and Google Firebase Cloud Messaging — used to deliver push notifications to your iOS or Android device respectively.
  • Google Maps Platform — when you view the in-app map, your device makes requests to Google's mapping service. This service may collect technical information (IP address, device, usage of the map) per Google's own policies.
  • Google reCAPTCHA Enterprise / Firebase App Check — assesses automated abuse of Website Firebase requests using technical browser, device and connection signals. Google processes the reCAPTCHA security signals on our behalf under its Cloud Terms and Cloud Data Processing Addendum; processing may take place internationally.
  • Cloudflare Turnstile — protects the Website contact form against automated abuse using browser and connection signals, including IP address and user-agent information.
  • Website hosting and email services — deliver the Website, process technical request information, and deliver/store messages you send to us.
  • Resend (Resend, Inc.) — used to send transactional emails (such as listing claim approvals or moderation notifications) on our behalf.
  • Stripe (Stripe Payments Europe Limited) — used to process payments from business customers who buy paid features such as sponsored placement or promoted events. Stripe is the controller for payment card data; we never see your card details.

If you tap a link in the App that opens a third-party website (such as a business's own website, a TripAdvisor listing or a ticket booking page), the App is no longer responsible for what happens once you leave. Those websites have their own privacy policies.

We do not sell your information. We do not share it with advertisers — the App and the Website do not show third-party advertisements. We do not share it with anyone else for marketing purposes.

7. International data transfers

Using a UK database or storage region does not mean all processing stays in the UK. Firebase Authentication processes sign-in data in the United States, and other providers may process information internationally. The applicable transfer arrangements depend on the provider and service; contact us if you would like information about the arrangements for your data.

8. Data retention and what happens when you delete your account

We retain information for the following periods:

  • Account information (email, display name, saved lists, account ID) — for as long as your account exists.
  • Push notification token — retained while the device is registered for notifications. Account deletion removes device records linked to your account. Outside account deletion, we clear a token when the notification provider reports that it is no longer registered; a token can remain until that report is received.
  • User-submitted listings, listing claims and events — published listings and events are kept while they remain part of the service. Private submission, claim and moderation records are kept while needed to review decisions, handle requests or disputes, and protect the service from misuse. These records are not currently deleted on a fixed 12-month schedule. Contact us if you would like a private record reviewed or removed.
  • Listing problem reports — retained privately while needed for review and moderation history, without a fixed automatic expiry. Deleting your account deletes your reports and their daily counters. The regular cleanup removes counters older than 45 days, so a monthly run can retain a counter for roughly 76 days; delayed cleanup can take longer.
  • Photos you upload — published photos are kept while the listing or event they are attached to remains in the App. Staged photos remain while they are referenced by an unresolved submission or edit. A daily clean-up removes unreferenced staged uploads once they are more than 14 days old; a failed deletion is logged for a later clean-up attempt. Contact us if you need a particular upload reviewed or removed.
  • Engagement events (analytics_events) — stored as individual engagement records used to maintain listing-performance counts. No automatic expiry is currently configured for these records. Records can include your account ID while you have an account; the account-deletion process removes that ID. See deletion behaviour below.
  • Google Analytics — user-level and event-level retention depends on the settings of the relevant Analytics property; there is no single retention period for every type of report. Aggregated reports may be retained longer. Contact us for the retention settings that apply to your request.
  • Payment and billing records — account deletion does not remove records held by Stripe or records we need for payment, accounting, tax, dispute or legal purposes. Retention depends on the record and the applicable provider or legal requirement; contact us if you need details about a particular record.

When you delete your account using the "Delete account" button in the App, the cleanup process covers the following records:

  • Deletes your account record and saved lists from Firestore.
  • Deletes listing problem reports and daily report counters attached to your account.
  • Deletes your Firebase Authentication record (so you can no longer sign in).
  • Deletes the push tokens for every device linked to your account.
  • Removes account-linked submitter details from listing submissions, claims and event submissions. Published content, including any public contact details it contains, is handled separately; contact us if you need that content removed.
  • Replaces your account ID on engagement records (analytics_events) with a null value, so that account ID is no longer attached to those records.
  • Removes you as the owner of any listing you had claimed. The listing remains in the App but becomes unclaimed.
  • Deletes pending event-submission uploads stored under your account's upload path. If you need other uploaded or published content removed, include it in your request.

Published photos that are already part of a live listing or event remain part of that listing or event. The cleanup described above removes records from the active Pocket Guides service. Current provider settings retain Firestore point-in-time recovery data and daily database backups for seven days, and retain soft-deleted uploaded files for seven days. These restricted recovery copies are not available through the App. Firebase Authentication follows the separate provider schedule described below.

You can also ask us to delete information about you at any time using the contact details below.

A restricted deletion marker containing the account ID and a timestamp is retained to prevent a delayed approval or payment notification from restoring ownership after deletion. Provider-held records may follow separate schedules: for example, Firebase says Authentication data is removed from its live and backup systems within 180 days after deletion is initiated. This does not make the deleted account available for sign-in.

9. Your rights under UK GDPR

You have the following rights over your personal information:

  • Right of access — to know what information we hold about you and receive a copy
  • Right to rectification — to correct inaccurate information
  • Right to erasure ("right to be forgotten") — to ask us to delete information about you
  • Right to restrict processing — to limit how we use your information
  • Right to data portability — to receive your information in a portable format
  • Right to object — to object to processing based on legitimate interests
  • Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at hello@pocket-guide.co.uk. We will respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your information properly.

10. Children's privacy

The App and the Website are intended for general audiences and are not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Security

We use industry-standard technical and organisational measures to protect the information we hold, including encryption in transit, restricted access to administrative tools, and reliance on Google Firebase's enterprise-grade infrastructure. However, no system is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the most recent change. If we make material changes, we will indicate this prominently in the App and on the Website.

13. Contact us

If you have questions about this Privacy Policy or about how we handle your information, please contact:

RISENORTHDIGITAL LTD (trading as Pocket Guides)
24 Kings Mill Lane, Settle, United Kingdom, BD24 9FD
Email: hello@pocket-guide.co.uk
Website: pocket-guide.co.uk